AZ-104 Question 21
Single answerYou are an Azure Administrator responsible for multiple resource groups. In one resource group, the security team wants only designated users to manage Azure Key Vaults, while all other users should be able to read resource properties only. Which single approach best meets this requirement?
- A
Assign the built-in Key Vault Contributor role to the designated users at the resource group scope and the Reader role to all other users
- B
Grant the built-in Owner role to the designated users at the subscription scope and the built-in Reader role to the resource group
- C
Assign the built-in Contributor role to the designated users at the resource group scope and leave the group’s default permissions unchanged
- D
Create two custom roles: one that allows Key Vault management and another for read-only access, then assign them to the designated users and other users respectively
Show answer and explanation
Correct answer: A
Explanation
Using the built-in Key Vault Contributor role specifically grants management access to Azure Key Vaults. The built-in Reader role then limits other users to read-only operations across the resource group, fulfilling both the security team's and the management requirements.
- A. Correct.
This ensures that only the designated users can fully manage the Azure Key Vaults while other users have read-only access to resources in the same group
- B. Incorrect.
Owner at subscription scope grants too many permissions across all resources and violates the principle of least privilege
- C. Incorrect.
Contributor at the resource group scope allows broad management permissions, potentially exceeding the requirement for Key Vault-only management
- D. Incorrect.
While this approach is valid, it is typically more complex than necessary when suitable built-in roles (Key Vault Contributor and Reader) already exist for this scenario